On this page
You installed a client, not a node plan
Beginners most often conflate four things: a graphical client provides buttons and screens, a core such as Mihomo processes connections, a subscription link delivers configuration to the client, and nodes are remote outbound routes inside that configuration. If any link is missing, the interface may open but networking will not behave as expected.
- Graphical client
- Manages subscriptions, policy groups, the system proxy, TUN, logs, and updates.
- Proxy core
- Reads YAML, matches rules, and establishes direct or proxied connections.
- Subscription link
- A credential-bearing remote address that returns nodes, groups, and rules during updates.
- Nodes
- The actual outbound connection; availability, protocol, and route are determined by the provider.
Downloading Clash Verge Rev, FlClash, or another client does not automatically provide nodes, and this site does not offer subscriptions. Conversely, a subscription link still requires a client that can read its format. Identifying what you lack first prevents many wrong turns.
Choose a client based on only three things: system, maintenance status, and core
Before downloading
| What to inspect | Why |
|---|---|
| Operating system and chip architecture | Windows x64, Windows ARM64, Apple Silicon, Intel, and Android packages are not interchangeable |
| Is the project still maintained? | The releases page, recent versions, and issue activity indicate current status |
| Which core it uses | Determines whether configuration fields, protocols, and features are compatible |
Desktop clients can be downloaded from an actively maintained project's Release page. For Android, verify the APK architecture and signing source. Clash in the name does not imply the same author or that menus from an old tutorial still exist.
After installation, confirm that the interface opens and the core remains stable. No subscription is imported yet, so if the program already crashes or reports core failed, address installation and the local environment instead of blaming a node.
Add a subscription to Profiles, then update and select it
From a link to the current configuration
Copy a Clash- or Mihomo-compatible subscription
Copy the complete HTTPS address, and do not send its token to an unfamiliar conversion site.
Add it on the Profiles / configuration screen
Give it a local name that identifies its source.
Update once manually
Wait for a new update time and watch for download failed or parse error.
Set it as the current configuration
The selection marker should be on the Profile you just updated.
A name in the list does not mean the import succeeded. After successful parsing, policy groups and nodes appear on the Proxies screen. If it remains empty, inspect the response format, account status, and current configuration instead of pasting the same address repeatedly.
A policy group defines selection behavior; a node is the actual outbound route
Entries such as “Auto Select,” “Fallback,” and “AI Services” on the Proxies screen are usually policy groups; expand them to find nodes. You manually choose in a select group, url-test selects according to probe latency, and fallback switches in order when the current node becomes unavailable.
Do not rely on an automatic group for the first connection. Choose one specific node and restore automatic selection only after a real request succeeds. Otherwise, you cannot tell whether the node failed or a health check switched outbound routes.
When choosing the first node, confirm
- Whether you clicked a policy group or a specific node
- Whether the group contains at least one node
- Node latency is only a probe result, not an availability guarantee
- Which outbound route the primary service group ultimately references
Under Rule mode, not every site uses the same node
Rule matches the configuration from top to bottom. Common domestic services and the local network may use DIRECT, other domains may enter a proxy group, and ads or dangerous addresses may use REJECT. Global sends every connection entering Clash to the global group, while Direct sends all of them directly.
Everyday use normally starts with Rule. If a site will not open, inspect its matched rule in Connections. Do not use Global as a permanent universal switch or assume that DIRECT means the client failed.
proxy-groups:
- name: 默认代理
type: select
include-all: true
proxies:
- DIRECT
rules:
- DOMAIN-SUFFIX,lan.example,DIRECT
- DOMAIN-SUFFIX,example.com,默认代理
- MATCH,默认代理Start browsers with the system proxy; consider TUN only for missed apps
The system proxy is the easiest entry point to reverse. Once enabled, browsers and many desktop apps send HTTP and HTTPS requests to Clash. Terminals, games, and some apps may ignore it and never appear in Connections.
TUN captures more TCP and UDP traffic through a virtual adapter. It needs extra system permissions and affects routing and DNS. Do not rush to enable TUN before ordinary browser requests work. Fewer variables make its actual benefit visible later.
When to switch to TUN
| Symptom | Action |
|---|---|
| The browser and common software work | Keep the system proxy |
| The browser works, but the terminal has no connection records | Configure the tool's proxy or compare with TUN |
| A connection appears but matches the wrong rule | Fix the rule; there is no need to expand the entry path |
| Every connection shows timeout | Inspect the node and network; TUN cannot revive a node |
The first success should be visible in Connections
Complete one verifiable request
Pin one node
Keep the mode on Rule and prevent automatic switching during the test.
Enable System Proxy
Confirm that the current client wrote it into system settings.
Visit a familiar site in the browser
Do not substitute the latency button for a real page.
Open Connections
Find the domain, matched rule, and actual outbound route.
If the page opens and the connection record is complete, the client, core, Profile, node, and system proxy form a working path. If the record is empty, return to the system proxy. If it shows DIRECT, read the rule. If it shows a node and then timeout, switch to another known-good node.
When something later fails, begin on the page where the error appears
Profile shows 401 / 403
The subscription credential or account status has a problem; do not reinstall the client.
Profile shows parse error
The response is incompatible with the core format; preserve the specific line number.
Proxies has nodes, but the page creates no Connections record
The app did not enter Clash; inspect the system proxy or other entry method.
Connections matches DIRECT
The rule chose direct access; determine whether that is expected.
Connections uses a node and then shows timeout
Compare the specific node, access network, and logs.
At this point, one real request has confirmed that the client, core, subscription, policy group, node, and system proxy work. If a later subscription update fails, retain the old configuration. If one node fails, switch only the node. Consider another traffic-capture method only when the app does not enter Connections.